Disabling Password Resets
I've come across numerous security hardening articles relating to various measures for disabling password resets (i.e. lost password retrieval).
I've read that SQL injection can be used to obtain the user email etc. and ultimately to gain control of the site by intercepting the password reset email is automatically sent to a user.
If I'm already protected against SQL injections (via security plugin), do I need to disable the password reset feature? Is it really a serious vulnerability?
Brute force attacks are on the rise. I've encountered several instances myself in recent months.